Hello and welcome back I need you to understand that DCB IP packet headers.
I mean one of you might say what the heck I mean why do we have to worry about bucket headers anticipated
here.
And my answer is please bear with me and find why it is important.
If you notice that all that network access control lists and in the security groups you are talking
about who's the source.
What's the protocol.
What's the point.
And then allowed inside in the Nakul and allow in the security group.
So these are the ways we can configure and that is inbound and outbound.
But I need to know if I want to customize our will on getting real or not whether it's inbound or about
doesn't matter.
I don't to understand when the traffic hits and gets inspected what will be the fields and where it
is going.
If I'm sitting on a specific port is that going to be a source.
Is it going to be the situation I need to understand.
And this is part of that tricky choices that you will get for the security group and then to control
this.
So let's have a look here what do we have.
So we have a use of the Internet on that.
I use that on the Internet and is trying to communicate with whichever I have in my ear.
So now maybe you see somewhere around those instances.
And I have two subnets I have a subnet here which is and that's a public subnet and I have a different
subnet here which is a private subnet where I have a database server I could be on my mind see my sequence
server begin to set about whatever it is.
OK so that the sport applies to mind as quote.
So when the traffic comes so here is the inbound direction.
So these are the packets and this is the response coming out to me.
So what the sequence of events they use other types that you are of the observer.
Like what for instance.
W w w dogs.
You can do it too.
Dot com so I typed that.
Then it goes to the DNS server on the Internet.
The server would say you know what if you want to go to this you have to head to 11. one that 1.1.
So the packet is formulated.
And here is the packet.
So what's the decision.
IP is 11 1 1 2 1.
So this is the packet that comes out from the user what is the point I'm trying to get to.
I have already done w w w So this is actually ATP and HTP is port 80.
Great.
How will I know this is a well known port.
So anyone working with HDTV will know or firewall or security or networking or applications know HDTV
is port 80 people get it.
So the distinction would be port 80.
But who sent it.
Because remember the traffic will come from the user to that web server and eventually settled we want
to respond to that user.
So I need to know they use a port and they use user IP address the source IP.
Let's just for the sake of example let's say it is 20 200 to 1.5 that's the IP address of the user.
So the source here is going to be 12:38 1.5.
And what will be the source port.
Usually the initiator of the connection because now he's going to be.
But it's not coming from a known protocol.
This is only a browser whether it is chrome or because Firefox or is Safadi So the source port will
be what we call an ephemeral port.
Great transients.
A temporary port.
So there is a range that the applications would use from one.
All the way to 65 5 3 5.
So this is a range so the user can or the application or the browser can just pick one number here let's
say 50000.
So the source code is from the ephemeral range and it is 15000 and then the payload itself what exactly
am I trying to get or put or what am I trying to do here.
It gets let's say the security group will allow us to set a vote in our So that will preserve will process
it.
And then there was a request to get something for me.
Now we're getting information from the way these Web Application Data are built in the application were
announced in a request down to the server to fetch some information that was part of the response that
this request is expected.
What this user is expecting.
So how would the package look like when it comes from the web to down to the database.
So the bucket will be the source would be the web server IP address.
So that web server easy to instance let's say it is 10 to one that 1.1.
And what's that station.
My destination is that 10 to that one the one case or the destination IP address is 10 to 1 1.
What is the destination port.
I'm talking to the database the sequel.
So the port is 3 3 0 6.
So here is the port 3 3 0 6.
What's the source IP.
As we said it's the web server IP address or the application server IP I just end up on that on that
one.
What's the source for.
Again it's emer.
So let's say I'm going to pick or that application with Paik for all four hours.
Good.
Now the database that assuming that this used to look for the database that green apps allow the traffic
that got the request not we Triche that information.
Now it has to respond right.
So let's look at the responses on the right side.
Who responding now.
The database for the return traffic is the source because he is the one responding right.
So this would be 10 to not one not one.
What is the source for it in this case the source port is 5:37 Why.
Because when the work was talking it was talking 2 3 3 0 6 when a response comes out it's coming from
3 3 0 6 or it is equal to 7.
Now what is that web server IP address.
We know that already that is standard one that 1.1.
So the destination I'm going to send this to is going to conduct one point.
What is that for.
It is exactly the source for that came with the packet that I need to respond to.
So it is for 4000 that comes to the Web now has all the information it needs to respond to the user.
So it has to form or build a packet and send it to the user.
Now what will be the headers in this case to the destination port that I'm going to send to is the same
source source that came with the original packet that came from the user.
So the destination port is 50000.
Exactly what is the destination IP.
It's exactly the same that came to me with a source packet that came from the user.
So it's going to be 20 to one that one the life what's the source IP the source IP is that web server
IP What is the source port 80.
Why.
Because when he requested the communication and sent me the packet d'Argent know he was talking to the
HDD he said it was on the said 10.
That one the one that one can't say here is the web server IPX.
So if it goes out now the question I have for you is is it going to roll out all the way to the user
with the source IP turned out one that won that one.
The answer is no.
Why.
Because this is a private ITV for adverts.
It's not even on the Internet.
So what will happen.
Remember when we said that the Internet Gateway will host the elastic IP or the public IP for that web
server or that we're facing instances.
That's exactly what will happen.
So now the 10.0 on that one that one is going to come here and it will be translated into the public
IP address of the instance.
OK which was the 11. one that won this one.
So this will be transformed into 12:49 the one that one.
And then the traffic would be sent out.
The most important thing I want you to understand here is so the client picks and if Harold Ford initiates
the request that this commission of which is so upset over destination port is the port that is bungs
the source of which is going to be the web server and port the destination is going to be the client
IP address and the ephemeral port that was chosen.
Why do they teach you all that or why do you guys spend all that.
Very simple reason.
Because when you are writing a rule for us to look at this list and you know where the topic will be
coming from and where it is going you need to know what's the source for what's the source IP what's
the point of decision.
IP in order to be able to write the words correctly.
OK.
So let's see why this is very important.
Let's look at the format of that security group inbound and outbound and inbound and outbound the inbound
on the school group it looks like.
So this is what you need to configure on us what's the type of your topic.
So the DNS traffic traffic ICMP traffic EECP traffic whatever it is.
And then once the protocol is EPEAT UDP ICMP What is the specific point.
Twenty two is that my sequel.
It's going to be asked is it be who is the source.
And the source is.
I mean if you have a specific source you can put it here if you have it and you can put it here if you
have it.
A source is another security group.
You can also configure your pay if I don't know the source if it's coming from the internet.
I'm not sure who is the source then.
In this case just right.
Zero zero zero zero zero.
So that means from any source on the outbound that action what's the difference here.
The main difference that the same fields do not change.
I'm not talking about the values I'm talking about this is portrayed in the Paltridge brother unpredicable
type time.
So what are we talking about.
I'm talking about.
This is the source of where it is coming from going into maybe a C and he here I don't ask about the
source because I know the sources might be because it's easy to instances.
Now I'm concerned for the hour long for the destination.
So when are you just coming to me.
General who is the source unfiltered based on that.
When it is sent from me from the BBC out I need to know who is the destination and fifth are based on
the then I can format access control lists on the inbound direction.
I have the rule number and I remember when we said that we have a sequence number and they are always
inspected from the lowest number.
So from 5 from five to 100.
The first one that will be inspected is five and then 10 on the 15th.
And until I get to 100 what if I don't find any of those.
Oh I you know these rules don't have a match.
Then you have an explicit deny all rule anything.
All the ports all protocols all traffic for any destination.
So if you have not configured something to allow that traffic it will be at night and that's it.
How about that implicit.
It doesn't show that.
But you know it is the game.
So here I have no idea that were denied because I can only find out here.
I have and you know as options.
So that's another difference.
On the outbound
on the outbound.
Exactly the same thing.
Your rules.
And then you have the experience I have the end for anything that does not match.
OK.
One important distinction also between the inbound and outbound is exactly the same thing the security
group I care about for inbound where it's coming from.
I care for the outbound where it's going to take.
So make no mistake about this they can't take you in the exact choices in question choices that they
would put you in a perfect role.
But then instead of the destination they would say source is that of the there was perfectly fine if
it was the source of the destination or if it was the destination of the source.
So you need to be careful about that.
You know our next lecture we are going to look at some scenarios about security groups and access to
some problems and then we'll see how we can think about solving them.
The architect which will put on the architect facts and we think about it see in the next lecture.